1. Field of the Invention
The present invention generally concerns communications security between network communications devices, in particular security implemented through packet- or frame-level encoding.
2. Description of the Related Art
In packet switch architectures commonly employed today there is, generally speaking, a central core or processor which switches multiple data streams operating at speeds of many millions or billions of bits per second. There are also peripheral devices which work on those streams as input interfaces, output interfaces, and/or subprocessors. The link between the central core and the peripherals is often implemented by using standard communications protocols such as Ethernet and/or Internet Protocol (IP) with standard packet formats. As the peripherals are slave devices to the core, there is a need for control packets to be sent between the core and the peripherals. These packets control such functions as enabling or disabling peripheral ports and gathering statistics from the ports. The use of such master/slave communications systems is well-known in the art.
There are two approaches commonly in use for carrying control packets between a core and its peripherals. One approach, referred to as out-of-band signaling, provides physical separation of the communication channels for control vs. user data packets. That separation can be provided by various means, such as physically separate wires, different carrier frequencies in a radio system, different wavelengths in a fiber system, etc. The common element of these systems is that separation of control vs. user data traffic does not rely on the contents of the packets or frames themselves.
The alternative approach is commonly referred to as in-band signaling. In the in-band approach, both user data and control frames are carried over the same communication channel. An Ethernet link between the core and a peripheral, as one in-band example, carries both user data packets and control packets. Correct operation of the system requires that both the core and the peripherals are reliably able to distinguish control packets from user data packets.
The current methodology of communicating between core and peripherals renders the system open to denial of service attacks by malicious users who “spoof” the control packets. Such spoofing takes the form of maliciously introducing packets configured as control packets into the network in an attempt to seize control or “own” the switch or communications device or simply to disrupt its operations. Current systems are also susceptible to the incorrect categorization of user data packets as control packets when, for example, standard test equipment (such as the Netcom Systems, Inc. SMARTBITS™ tester) is configured to run test packets filled with random data through the switch. These random data packets can, probabilistically, assume a format that may match that of a control packet, thereby causing current network communications devices to misinterpret the random data packet as a control packet with deleterious affects. (SMARTBITS is a trademark of Netcom Systems, Inc. of Calabasas, Calif.)
Communications protocols other than Ethernet and IP are of course also possible. For example, asynchronous transfer mode (ATM) frames may be used to communicate between elements of a distributed switching or routing system. Accordingly, the present problem is not limited to packet-oriented data; the terms “packet” and “frame” may be used interchangeably in the context of the present disclosure. One of ordinary skill in the art will readily appreciate that any data packetization or framing scheme will face the same problems.
What is needed is a system whereby control and data packets or frames are reliably and rapidly distinguishable from one another in transit and on receipt in a communications device. Furthermore, such a system must be robust and resistant to spoofing by outside users as well as resistant to packet mis-identification when configured for testing.